{"id":"CVE-2017-15273","details":"Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload, e.g., XSS code, to be saved as titles in internal artefacts.","modified":"2026-10-24T10:30:41.194043619Z","published":"2017-10-31T18:29:00.343Z","database_specific":{},"references":[{"type":"FIX","url":"https://bugs.launchpad.net/mahara/+bug/1719472"},{"type":"FIX","url":"https://bugs.launchpad.net/mahara/+bug/1719480"},{"type":"FIX","url":"https://bugs.launchpad.net/mahara/+bug/1720034"},{"type":"FIX","url":"https://mahara.org/interaction/forum/topic.php?id=8081"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/maharaproject/mahara","events":[{"introduced":"48a238a2f76a7ea322580fe93b7c026becd9acce"},{"last_affected":"9361501a61949c5778ef3506763c21effe3b66b7"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:mahara:mahara:15.04:rc1:*:*:*:*:*:*","range":[{"introduced":"15.04-rc1"},{"last_affected":"15.04-rc1"}],"source":"CPE_STRING"},{"range":[{"introduced":"15.04-rc2"},{"last_affected":"15.04-rc2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:15.04:rc2:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:mahara:mahara:15.04.0:*:*:*:*:*:*:*","range":[{"introduced":"15.04.0"},{"last_affected":"15.04.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:15.04.1:*:*:*:*:*:*:*","range":[{"introduced":"15.04.1"},{"last_affected":"15.04.1"}]},{"range":[{"introduced":"15.04.2"},{"last_affected":"15.04.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:15.04.2:*:*:*:*:*:*:*"},{"range":[{"introduced":"15.04.3"},{"last_affected":"15.04.3"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:15.04.3:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:15.04.4:*:*:*:*:*:*:*","range":[{"introduced":"15.04.4"},{"last_affected":"15.04.4"}]},{"cpe":"cpe:2.3:a:mahara:mahara:15.04.5:*:*:*:*:*:*:*","range":[{"introduced":"15.04.5"},{"last_affected":"15.04.5"}],"source":"CPE_STRING"},{"range":[{"introduced":"15.04.6"},{"last_affected":"15.04.6"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:15.04.6:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:15.04.7:*:*:*:*:*:*:*","range":[{"introduced":"15.04.7"},{"last_affected":"15.04.7"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:15.04.8:*:*:*:*:*:*:*","range":[{"introduced":"15.04.8"},{"last_affected":"15.04.8"}]},{"range":[{"introduced":"15.04.9"},{"last_affected":"15.04.9"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:15.04.9:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:15.04.10:*:*:*:*:*:*:*","range":[{"introduced":"15.04.10"},{"last_affected":"15.04.10"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:15.04.11:*:*:*:*:*:*:*","range":[{"introduced":"15.04.11"},{"last_affected":"15.04.11"}]},{"range":[{"introduced":"15.04.12"},{"last_affected":"15.04.12"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:15.04.12:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:15.04.13:*:*:*:*:*:*:*","range":[{"introduced":"15.04.13"},{"last_affected":"15.04.13"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:15.04.15:*:*:*:*:*:*:*","range":[{"introduced":"15.04.15"},{"last_affected":"15.04.15"}]},{"cpe":"cpe:2.3:a:mahara:mahara:16.04:rc1:*:*:*:*:*:*","range":[{"introduced":"16.04-rc1"},{"last_affected":"16.04-rc1"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:16.04:rc2:*:*:*:*:*:*","range":[{"introduced":"16.04-rc2"},{"last_affected":"16.04-rc2"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:16.04.0:*:*:*:*:*:*:*","range":[{"introduced":"16.04.0"},{"last_affected":"16.04.0"}]},{"cpe":"cpe:2.3:a:mahara:mahara:16.04.1:*:*:*:*:*:*:*","range":[{"introduced":"16.04.1"},{"last_affected":"16.04.1"}],"source":"CPE_STRING"},{"range":[{"introduced":"16.04.2"},{"last_affected":"16.04.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:16.04.2:*:*:*:*:*:*:*"},{"range":[{"introduced":"16.04.3"},{"last_affected":"16.04.3"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:16.04.3:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:16.04.4:*:*:*:*:*:*:*","range":[{"introduced":"16.04.4"},{"last_affected":"16.04.4"}]},{"cpe":"cpe:2.3:a:mahara:mahara:16.04.5:*:*:*:*:*:*:*","range":[{"introduced":"16.04.5"},{"last_affected":"16.04.5"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:16.04.6:*:*:*:*:*:*:*","range":[{"introduced":"16.04.6"},{"last_affected":"16.04.6"}]},{"range":[{"introduced":"16.04.7"},{"last_affected":"16.04.7"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:16.04.7:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:16.04.8:*:*:*:*:*:*:*","range":[{"introduced":"16.04.8"},{"last_affected":"16.04.8"}]},{"cpe":"cpe:2.3:a:mahara:mahara:16.10:rc1:*:*:*:*:*:*","range":[{"introduced":"16.10-rc1"},{"last_affected":"16.10-rc1"}],"source":"CPE_STRING"},{"range":[{"introduced":"16.10-rc2"},{"last_affected":"16.10-rc2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:16.10:rc2:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:16.10.0:*:*:*:*:*:*:*","range":[{"introduced":"16.10.0"},{"last_affected":"16.10.0"}]},{"range":[{"introduced":"16.10.1"},{"last_affected":"16.10.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:16.10.1:*:*:*:*:*:*:*"},{"range":[{"introduced":"16.10.2"},{"last_affected":"16.10.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:16.10.2:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:16.10.3:*:*:*:*:*:*:*","range":[{"introduced":"16.10.3"},{"last_affected":"16.10.3"}]},{"cpe":"cpe:2.3:a:mahara:mahara:16.10.4:*:*:*:*:*:*:*","range":[{"introduced":"16.10.4"},{"last_affected":"16.10.4"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:16.10.5:*:*:*:*:*:*:*","range":[{"introduced":"16.10.5"},{"last_affected":"16.10.5"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:17.04:rc1:*:*:*:*:*:*","range":[{"introduced":"17.04-rc1"},{"last_affected":"17.04-rc1"}]},{"cpe":"cpe:2.3:a:mahara:mahara:17.04:rc2:*:*:*:*:*:*","range":[{"introduced":"17.04-rc2"},{"last_affected":"17.04-rc2"}],"source":"CPE_STRING"},{"range":[{"introduced":"17.04.0"},{"last_affected":"17.04.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:17.04.0:*:*:*:*:*:*:*"},{"range":[{"introduced":"17.04.1"},{"last_affected":"17.04.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:mahara:mahara:17.04.1:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:mahara:mahara:17.04.2:*:*:*:*:*:*:*","range":[{"introduced":"17.04.2"},{"last_affected":"17.04.2"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:mahara:mahara:17.04.3:*:*:*:*:*:*:*","range":[{"introduced":"17.04.3"},{"last_affected":"17.04.3"}],"source":"CPE_STRING"}]}}],"versions":["15.04-rc1","15.04-rc2","15.04.0","15.04.1","15.04.10","15.04.11","15.04.12","15.04.13","15.04.15","15.04.2","15.04.3","15.04.4","15.04.5","15.04.6","15.04.7","15.04.8","15.04.9","16.04-rc1","16.04-rc2","16.04.0","16.04.1","16.04.2","16.04.3","16.04.4","16.04.5","16.04.6","16.04.7","16.04.8","16.10-rc1","16.10-rc2","16.10.0","16.10.1","16.10.2","16.10.3","16.10.4","16.10.5","17.04-rc1","17.04-rc2","17.04.0","17.04.1","17.04.2","17.04.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15273.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}